Re: [syzbot] [usb-storage?] divide error in alauda_transport

[syzbot <syzbot+dc208a8cf8d37cf3e5ac@syzkaller.appspotmail.com>]

syzbot has found a reproducer for the following issue on:

HEAD commit:    818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=157ff979580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
dashboard link: https://syzkaller.appspot.com/bug?extid=dc208a8cf8d37cf3e5ac
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=113d1625580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+dc208a8cf8d37cf3e5ac@syzkaller.appspotmail.com

Oops: divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 6620 Comm: usb-storage Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:alauda_read_data drivers/usb/storage/alauda.c:953 [inline]
RIP: 0010:alauda_transport+0xe5a/0x35c0 drivers/usb/storage/alauda.c:1187
Code: 01 45 85 ed 0f 84 6d 1c 00 00 c7 04 24 00 00 00 00 8b 5c 24 20 e8 46 38 53 fa 31 d2 48 8b 7c 24 08 89 d8 89 5c 24 20 41 89 df <f7> 74 24 70 89 c3 89 54 24 10 89 de e8 05 c1 ff ff 44 0f b7 74 24
RSP: 0018:ffffc900044ff9d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87b7c98a RDI: ffff8880578f8e90
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f741d1ca6e4 CR3: 0000000054fb4000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 usb_stor_invoke_transport+0xe7/0x15c0 drivers/usb/storage/transport.c:611
 usb_stor_control_thread+0x5e4/0xae0 drivers/usb/storage/usb.c:462
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:alauda_read_data drivers/usb/storage/alauda.c:953 [inline]
RIP: 0010:alauda_transport+0xe5a/0x35c0 drivers/usb/storage/alauda.c:1187
Code: 01 45 85 ed 0f 84 6d 1c 00 00 c7 04 24 00 00 00 00 8b 5c 24 20 e8 46 38 53 fa 31 d2 48 8b 7c 24 08 89 d8 89 5c 24 20 41 89 df <f7> 74 24 70 89 c3 89 54 24 10 89 de e8 05 c1 ff ff 44 0f b7 74 24
RSP: 0018:ffffc900044ff9d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87b7c98a RDI: ffff8880578f8e90
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f741d1ca6e4 CR3: 0000000054fb4000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	01 45 85             	add    %eax,-0x7b(%rbp)
   3:	ed                   	in     (%dx),%eax
   4:	0f 84 6d 1c 00 00    	je     0x1c77
   a:	c7 04 24 00 00 00 00 	movl   $0x0,(%rsp)
  11:	8b 5c 24 20          	mov    0x20(%rsp),%ebx
  15:	e8 46 38 53 fa       	call   0xfa533860
  1a:	31 d2                	xor    %edx,%edx
  1c:	48 8b 7c 24 08       	mov    0x8(%rsp),%rdi
  21:	89 d8                	mov    %ebx,%eax
  23:	89 5c 24 20          	mov    %ebx,0x20(%rsp)
  27:	41 89 df             	mov    %ebx,%r15d
* 2a:	f7 74 24 70          	divl   0x70(%rsp) <-- trapping instruction
  2e:	89 c3                	mov    %eax,%ebx
  30:	89 54 24 10          	mov    %edx,0x10(%rsp)
  34:	89 de                	mov    %ebx,%esi
  36:	e8 05 c1 ff ff       	call   0xffffc140
  3b:	44                   	rex.R
  3c:	0f                   	.byte 0xf
  3d:	b7 74                	mov    $0x74,%bh
  3f:	24                   	.byte 0x24


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.